Lucene search

IcscertCVELIST:CVE-2021-38424

HistoryOct 21, 2021 - 12:00 a.m.

CVE-2021-38424 Delta Electronics DIALink

2021-10-2100:00:00

CWE-1236

icscert

www.cve.org

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.6%

JSON

The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may then be executed when it is opened with a spreadsheet application.

CNA Affected

[
  {
    "product": "DIALink",
    "vendor": "Delta Electronics",
    "versions": [
      {
        "lessThanOrEqual": "1.2.4.0",
        "status": "affected",
        "version": "All",
        "versionType": "custom"
      }
    ]
  }
]

References

us-cert.cisa.gov/ics/advisories/icsa-21-294-02